CVE-2025-0509
CVE-2025-0509 · Signing Checks Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
CVSS 7.3 · High · EPSS 0.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
sparkle
- Versions
- ≥ 0, < 2.6.4: Affected (semver)
Update to 2.6.4
openjdk-9 Ubuntu:16.04:LTS
- Versions
- 9~b88-1
- 9~b101-2ubuntu2
- 9~b102-1
- 9~b113-0ubuntu1
- 9~b114-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-13 Ubuntu:20.04:LTS
- Versions
- 13+33-1
- 13.0.1+9-2
- 13.0.2+8-1
- 13.0.2+8-2
- 13.0.3+3-1ubuntu2
- 13.0.4+8-1~20.04
- 13.0.7+5-0ubuntu1~20.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-16 Ubuntu:20.04:LTS
- Versions
- 16.0.1+9-1~20.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-18 Ubuntu:22.04:LTS
- Versions
- 18~15ea-4
- 18~20ea-1
- 18~32ea-1
- 18~36ea-1
- 18.0.2+9-2~22.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published